QualityReboot

If you're a felon, you typically can't get traditional employment. For most people, it's a shorter jump to "criminal" than "consultant".

I moved from San Francisco to South Florida as an experiment in being fully remote. It's been pretty good so far, but if I was looking for another job, I'd hit up everyone I know in SF for a remote position first.

There aren't many like-minded people here, and that's kind of nice for a change. I still love San Francisco, but it simply priced me out of living there. I'd rather retire in 5 years here than work another 30 there.

It's not bad faith, and it's not flamebait.

1) He's technically correct, the best kind of correct.

2) That's tptacek you're suggesting to ban. He's a fixture here and has been an outstanding contributor to this community since near the beginning.

How would that help though? If you have a compromised USB interface, and you're entering your pin on that machine, you could just capture the keyboard input anyway.

I just got a yubikey and found this guide today. It's quite good.

One thing that I still haven't found a good answer for that's not mentioned in the guide: what's KDF for?

The new yubikey firmware has release notes here: https://support.yubico.com/support/solutions/articles/150000...

This is the bit that has me lost:

> To remove the transmission and on-card storage of OpenPGP PINs in plain text, the YubiKey supports the Key Derived Function (KDF) functionality. With the KDF function enabled, the PIN is stored as a hash on the YubiKey. When entering the PIN to the OpenPGP Smart Card, the OpenPGP client will only pass the hashed value, never passing the PIN directly. KDF functionality is set on the card itself, and communicated to the client; it is transparent to the user. Should the KDF functionality not be enabled, the PIN function will work as previously. The KDF function is listed in section 4.3.2 of the OpenPGP Smart Card 3.4 spec.

Can someone explain to me how KDF matters at all here?

It seems like the keys are encrypted on the yubikey via pin, or at least protected in hardware via pin, and that the pin is stored on the device. KDF seems to take that plain text pin and replace it with a hashed pin. If you steal my yubikey, it looks like KDF would prevent you from... dumping the PIN? But if you could dump the pin, wouldn't you just dump the key instead? I can't seem to figure out the threat model for this feature.

You produce some of the most interesting threads I've read on Twitter. Thanks for sharing as much as you do.

Out of curiosity, why not mastodon? Do you see a path from Twitter to a federated or decentralized service?

So what you're saying is if work is already lonely, isolating, exhausting, precarious, with little support, then I might as well go into leadership?

That does sound awful. Here's what I do: block all ads.

I can't stop the data collection, but I can stop ads. If I ever see an ad, I stop what I'm doing and figure out how to remove that ad from my life forever.

So yeah, I'm fully tracked, and I have no privacy, but at least I'm not being influenced by the ads that come from processing all my data.

I also try to block as much data collection as possible, but I realize that's not fully in my control.

As best as I can tell from this thread, if you make use of any service in any way that could be interpreted as unintended by the service provider, you're a criminal.

It makes me wonder if using 1.1.1.1 on my network is a crime. Sure my ISP is letting my DNS queries through, but think of all the analytics that they're missing about me.

Is it also theft if I run sshd on udp 53 and I happen to be able to connect?

How about if I run sshd on tcp 22 and it's not blocked?

Is it illegal if I just want to see if a dns change I made has propagated and I query an A record?

It seems obvious (to me) that a judge would say "It's not theft if you're giving it away. If you have a problem with how people are using your free service, add restrictions. Case dismissed."

I would hope that the court uses their human brain to make a judgment of my intent and the intent of the service provider. My intent is to have free DNS access to communicate with my server. The service provider intended to provide a public access point with free DNS and no restrictions on its use. The conclusion should be obvious.

I suppose adblock is theft too?

I'm floored that this is apparently how people are reasoning about the world now. Especially on HN.

There is no circumventing of any access control here. If a service is giving a public access point, on public spectrum, and they let you connect, and they allow you to use DNS, you should be able to use DNS however their access control systems allow you to use it.

Now if you find an exploit in their captive portal that allows you access to their service, then sure, that's illegal, because you're breaking into something.

You can't circumvent access controls if the access control list is wide open.

Can I use my solar powered calculator under a street light? Or is that theft of service too?

Or even just let those users alone. Users aren't stealing service if it's not even the same service. It's much slower than buying wifi from the captive portal.

DNS tunnelling is not fast or convenient. Places deploying captive portals have probably looked at the risk to their business from it and have decided not to worry about it.

I can't believe that using a slow DNS connection, intentionally made public, to tunnel traffic would be considered theft or criminal.

How many free samples do I have to eat before I'm a theif? I don't believe I'm a thief until the offer for free samples is rescinded.

How can it be theft of service when they can deny you service at any time automatically by identifying abnormally heavy users and removing them?

This isn't like bypassing the electrical grid by running your own line from somebody else's service.

This is like saying it's theft of service to read a chapter in the bookstore. If you hang out there all day, you might get kicked out, but that's not a crime.

The courts might agree with you, but only because "computers are hard".

There's a world of difference between tunneling over DNS and compromising servers. Or at least, there should be.

> Note: this is most likely illegal .. in every jurisdiction. So .. don't actually do this.

Sad if true. If a service is providing public DNS access without any service agreement, I don't see how making DNS queries with it could be illegal, especially on a public radio channel.

You might be right, but how?

It's certainly within their right to ban you by filtering out certain queries though.

Just out of curiosity, why awk? I've only ever used it for simple text splitting and didn't really know people did more with it. Is it a tool worth learning?

See also https://en.m.wikipedia.org/wiki/SCO%E2%80%93Linux_disputes

I've had fantastic experience with airvpn. They're cheap, fast, reliable, and support all the configuration types you could want. I'm not affiliated with them but I'm surprised nobody here has mentioned them yet. By far the best VPN provider IMO.

I don't understand how solving a new problem that you haven't solved before is somehow development instead of research. All software is research. If someone had already solved it and built it, you could just copy their solution.

I've been doing dev work my whole life, and the only thing I can say about estimates is to underpromise and overdeliver.

BBC showing timelapse: https://youtu.be/HyzT5b0tNtk

I can think of a few: free speech advocates, libertarians, and long-time RMS supporters.

The thing I feel bad about with RMS is that he's clearly not able to read the room, which used to be considered quirky at best and unpleasant at worst, but now he finds himself unable to function at all in a society that he doesn't understand.

Most of the stuff he's saying would have been fringe in the 90s, but now it's unacceptable and worthy of exile.

Society seems to be settling in on global norms due to the rise of social media. The more engaged you are with it, the more you know what's cancelled and what's trending.

> Just pray you don't speak against mob or they'll cancel you.

I think the prudent strategy is to understand what's being cancelled today and make sure you're on the right side of it. It's really pretty easy to do just by reading HN.

Just know that you're always speaking to the mob and you won't get canceled. If you have views that disgust the mob, you're going to end up like RMS.

A lot of people are upset about cancel culture, but if you embrace it, it's pretty easy to exploit. You don't have to do the canceling yourself, but if you understand it, it's like a cheat sheet for being socially "right" on every hot button issue. I can fit in any liberal circle with ease because it's so predictable, and I know how to be edgy if I want. And because there's only two tribes that are pretty much opposite, I can do the same with conservatives.

You can still have all the radical opinions you want, you just can't do public stuff with them under your real identity, if you want to avoid being canceled. Maybe we'll see a resurgence of anonymous early-internet type culture, where people have aliases and keep their views disconnected from their public life. I think that works pretty well, because most activism can be done anonymously. It's not that hard to conform irl and do meaningful things under an alias online.

Yup, that's what I meant.

Your sponsor can sign off that you won't become a public charge and they'll become your caretaker.

There should be another word for it.

"Work", for most people, is a thing you have to do until you die or retire.

"Work", for rich people, is a hobby that you can quit whenever you want without suffering dire consequences.

Same word but totally different meanings based on your net worth.

Yeah but it's mostly about immunizations. You can still immigrate if you're disabled but have a caretaker.

I've heard people in the political world talk about buying and selling email lists, which I thought was illegal, but seems to be common practice.

Yeah. The same buttons do different things, but what they'll do depends which mode you've got selected. If you remember the remotes where it blinks an LED under the selected mode (tv/aux/DVD/whatever) as you're giving input with other buttons, that's a helpful reference.